I'm sure you guys get this question often and I'm sorry to be contributing to the mess. But I wouldn't be posting if I had been able to find the answer myself.
Basically the title, I've been at this for more than 2 weeks now and this isn't even the first time I've tried to do this. I've failed once before and got so frustrated I just gave up altogether.
What I'm trying to do is set up my OpenVPN server to not redirect all client internet traffic through itself essentially the same as
https://forums.openvpn.net/viewtopic.php?t=11344. However, everything I try just breaks something else, or most commonly prevents clients from browsing the web (I suspect it has to do with DNS as you can still connect directly via IP). However, when I don't touch any settings it works fine but redirects all internet traffic.
I used Nyr's OpenVPN Roadwarrior script
https://github.com/Nyr/openvpn-install which has made the initial setup so much easier.
local 192.168.1.110
port 1194
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key
dh dh.pem
auth SHA512
tls-crypt tc.key
topology subnet
server 10.8.0.0 255.255.255.0
push "redirect-gateway def1 bypass-dhcp"
ifconfig-pool-persist ipp.txt
push "dhcp-option DNS 1.1.1.1"
push "dhcp-option DNS 1.0.0.1"
keepalive 10 120
cipher AES-256-CBC
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status.log
verb 3
crl-verify crl.pem
explicit-exit-notify
duplicate-cn
client-to-client
client
dev tun
proto udp
remote *my domain name* 1194
resolv-retry infinite
nobind
persist-key
persist-tun
remote-cert-tls server
auth SHA512
cipher AES-256-CBC
ignore-unknown-option block-outside-dns
block-outside-dns
verb 3
pull-filter ignore "redirect-gateway"
<ca>
I've tried:
Changing
dev tun to
dev tap which made absolutely no difference.
Adding
pull-filter ignore "redirect-gateway" to the client.ovpn file just caused an issue with web browsing/DNS as stated above.
Commenting out;
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 1.1.1.1"
push "dhcp-option DNS 1.0.0.1"
which just caused the same dns issue.
Removing
def1 from
"redirect-gateway def1 bypass-dhcp" made no difference
If it helps clear things up for whoever may read this, this is the log file from one of my test clients
Client log:
Fri Apr 24 15:41:26 2020 OpenVPN 2.4.8 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [LZ4] [PKCS11] [AEAD] built on Oct 31 2019
Fri Apr 24 15:41:26 2020 Windows version 6.2 (Windows 8 or greater) 64bit
Fri Apr 24 15:41:26 2020 library versions: OpenSSL 1.1.0l 10 Sep 2019, LZO 2.10
Enter Management Password:
Fri Apr 24 15:41:26 2020 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340
Fri Apr 24 15:41:26 2020 Need hold release from management interface, waiting...
Fri Apr 24 15:41:27 2020 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340
Fri Apr 24 15:41:27 2020 MANAGEMENT: CMD 'state on'
Fri Apr 24 15:41:27 2020 MANAGEMENT: CMD 'log all on'
Fri Apr 24 15:41:27 2020 MANAGEMENT: CMD 'echo all on'
Fri Apr 24 15:41:27 2020 MANAGEMENT: CMD 'bytecount 5'
Fri Apr 24 15:41:27 2020 MANAGEMENT: CMD 'hold off'
Fri Apr 24 15:41:27 2020 MANAGEMENT: CMD 'hold release'
Fri Apr 24 15:41:27 2020 Outgoing Control Channel Encryption: Cipher 'AES-256-CTR' initialized with 256 bit key
Fri Apr 24 15:41:27 2020 Outgoing Control Channel Encryption: Using 256 bit message hash 'SHA256' for HMAC authentication
Fri Apr 24 15:41:27 2020 Incoming Control Channel Encryption: Cipher 'AES-256-CTR' initialized with 256 bit key
Fri Apr 24 15:41:27 2020 Incoming Control Channel Encryption: Using 256 bit message hash 'SHA256' for HMAC authentication
Fri Apr 24 15:41:27 2020 MANAGEMENT: >STATE:1587706887,RESOLVE,,,,,,
Fri Apr 24 15:41:27 2020 TCP/UDP: Preserving recently used remote address: [AF_INET]REDACTED:1194
Fri Apr 24 15:41:27 2020 Socket Buffers: R=[65536->65536] S=[65536->65536]
Fri Apr 24 15:41:27 2020 UDP link local: (not bound)
Fri Apr 24 15:41:27 2020 UDP link remote: [AF_INET]REDACTED:1194
Fri Apr 24 15:41:27 2020 MANAGEMENT: >STATE:1587706887,WAIT,,,,,,
Fri Apr 24 15:41:27 2020 MANAGEMENT: >STATE:1587706887,AUTH,,,,,,
Fri Apr 24 15:41:27 2020 TLS: Initial packet from [AF_INET]REDACTED:1194, sid=37770cb0 2b540138
Fri Apr 24 15:41:27 2020 VERIFY OK: depth=1, CN=ChangeMe
Fri Apr 24 15:41:27 2020 VERIFY KU OK
Fri Apr 24 15:41:27 2020 Validating certificate extended key usage
Fri Apr 24 15:41:27 2020 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
Fri Apr 24 15:41:27 2020 VERIFY EKU OK
Fri Apr 24 15:41:27 2020 VERIFY OK: depth=0, CN=server
Fri Apr 24 15:41:27 2020 Control Channel: TLSv1.2, cipher TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384, 2048 bit RSA
Fri Apr 24 15:41:27 2020 [server] Peer Connection Initiated with [AF_INET]REDACTED:1194
Fri Apr 24 15:41:28 2020 MANAGEMENT: >STATE:1587706888,GET_CONFIG,,,,,,
Fri Apr 24 15:41:28 2020 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Fri Apr 24 15:41:28 2020 PUSH: Received control message: 'PUSH_REPLY,redirect-gateway bypass-dhcp,dhcp-option DNS 1.1.1.1,dhcp-option DNS 1.0.0.1,route-gateway 10.8.0.1,ping 10,ping-restart 120,ifconfig 10.8.0.2 255.255.255.0,peer-id 0,cipher AES-256-GCM'
Fri Apr 24 15:41:28 2020 Pushed option removed by filter: 'redirect-gateway bypass-dhcp'
Fri Apr 24 15:41:28 2020 OPTIONS IMPORT: timers and/or timeouts modified
Fri Apr 24 15:41:28 2020 OPTIONS IMPORT: --ifconfig/up options modified
Fri Apr 24 15:41:28 2020 OPTIONS IMPORT: route-related options modified
Fri Apr 24 15:41:28 2020 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Fri Apr 24 15:41:28 2020 OPTIONS IMPORT: peer-id set
Fri Apr 24 15:41:28 2020 OPTIONS IMPORT: adjusting link_mtu to 1656
Fri Apr 24 15:41:28 2020 OPTIONS IMPORT: data channel crypto options modified
Fri Apr 24 15:41:28 2020 Data Channel: using negotiated cipher 'AES-256-GCM'
Fri Apr 24 15:41:28 2020 Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
Fri Apr 24 15:41:28 2020 Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
Fri Apr 24 15:41:28 2020 interactive service msg_channel=0
Fri Apr 24 15:41:28 2020 open_tun
Fri Apr 24 15:41:28 2020 TAP-WIN32 device [Local Area Connection] opened: \\.\Global\{B2440EE9-0EB2-4B2E-AB24-675EF61FCECC}.tap
Fri Apr 24 15:41:28 2020 TAP-Windows Driver Version 9.24
Fri Apr 24 15:41:28 2020 Notified TAP-Windows driver to set a DHCP IP/netmask of 10.8.0.2/255.255.255.0 on interface {B2440EE9-0EB2-4B2E-AB24-675EF61FCECC} [DHCP-serv: 10.8.0.0, lease-time: 31536000]
Fri Apr 24 15:41:28 2020 Successful ARP Flush on interface [45] {B2440EE9-0EB2-4B2E-AB24-675EF61FCECC}
Fri Apr 24 15:41:28 2020 MANAGEMENT: >STATE:1587706888,ASSIGN_IP,,10.8.0.2,,,,
Fri Apr 24 15:41:28 2020 Block_DNS: WFP engine opened
Fri Apr 24 15:41:28 2020 Block_DNS: Using existing sublayer
Fri Apr 24 15:41:28 2020 Block_DNS: Added permit filters for exe_path
Fri Apr 24 15:41:28 2020 Block_DNS: Added block filters for all interfaces
Fri Apr 24 15:41:28 2020 Block_DNS: Added permit filters for TAP interface
Fri Apr 24 15:41:33 2020 TEST ROUTES: 0/0 succeeded len=0 ret=1 a=0 u/d=up
Fri Apr 24 15:41:33 2020 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Fri Apr 24 15:41:33 2020 Initialization Sequence Completed
Fri Apr 24 15:41:33 2020 MANAGEMENT: >STATE:1587706893,CONNECTED,SUCCESS,10.8.0.2,REDACTED,1194,,
Fri Apr 24 15:49:05 2020 Closing TUN/TAP interface
Fri Apr 24 15:49:05 2020 TAP: DHCP address released
Fri Apr 24 15:49:05 2020 SIGTERM[hard,] received, process exiting
Fri Apr 24 15:49:05 2020 MANAGEMENT: >STATE:1587707345,EXITING,SIGTERM,,,,,
I've run out of ideas and everything I've got from google just says to "remove or ignore redirect gateway" which hasn't helped. I would IMMENSELY appreciate any info/help I could get regarding this issue.
